TL;DR
Analysis of an Android dropper distributed as a fake VPN app
- Multi stage malware
- Use of obfuscation techniques
- Full static analysis (because I <3 it)
Powershell dropper to Amatera stealer
TL;DR
In-depth analysis of a Powershell dropper:
- 5 stages malware - from an ASCII-encoded PowerShell dropper down to a custom C2 implant phoning home to a hardcoded IP
- Obfuscated Powershell scripts with opaq predicats
- Custom API hashing, aPLib, rolling XOR
- C2 Beacon with SNI spoofing, json+zip exfiltration, encoded endpoints - Amatera like
Static Analysis of GLOBAL GROUP Ransomware: From Encrypted Config to Panic Mode
Analysis Date: January 7, 2026
Methodology: Static analysis only
Sample: f6f7a37b49310287a253dbdf81e22f0593f44111215ca9308e46d2c68516196f
TL;DR
In-depth analysis of GLOBAL GROUP ransomware (RaaS), revealing:
- An encrypted
.configsection using a custom XOR + LCG algorithm - Hybrid encryption: Curve25519 (ECDH) + SHA-512 (KDF) + HC-128 (stream cipher)
- The “hash” at config offset 0x843 is actually the builder’s Curve25519 public key
- Three encryption modes based on file size (including a “panic” mode)
- Per-file ephemeral keys with proper asymmetric cryptography
- A builder structure allowing per-victim custom configs
Reversing a StealC Infostealer
TL;DR
Static analysis of a StealC infostealer that uses the Heaven’s Gate technique to transition from 32-bit to 64-bit mode, trying to bypass EDR hooks. Features RC4-encrypted config strings, a custom “MZER” payload marker, and direct syscalls. Successfully extracted the C2 server, decryption key, and 150+ encrypted strings without dynamic execution — full IOCs at the bottom for anyone who just wants the indicators.
Reversing random stealer
Intro
It had been a while since I last took the time to reverse a real malware sample from scratch.
To avoid getting rusty (and because it’s genuinely fun), I gave myself a simple challenge: grab a completely random malware sample and see how far I could go analyzing it.
Off to MalShare, random click, download a binary without knowing what I was getting into.
Spoiler: it wasn’t a crappy crack — it was a fairly ambitious stealer, with password theft, Discord tokens, encryption, and the usual toolkit.
AFL - Introduction
This is a simple walkthrough to install, setup and run AFL against an open source dumb C program.
What is AFL
American fuzzy lop is a security-oriented fuzzer that employs a novel type of compile-time instrumentation and genetic algorithms to automatically discover clean, interesting test cases that trigger new internal states in the targeted binary. This substantially improves the functional coverage for the fuzzed code.
– AFL website
Install AFL
Download
First, download the latest AFL source code:
Delitcrypt
Intro
This article is about reversing a rust pre-compilation macro that obfuscates strings in the compiled binary.
Another point that will be discussed is the development of a BinaryNinja plugin. I’m writing the article as I go along,
to capture the process as closely as possible, with its changes of direction, disappointments and achievements :)
The purpose of this story is not to provide a turnkey plugin, but rather to explain my reverse engineering methodologies and thoughts,
as well as to progress in the use of the Binary Ninja API. No more spoiler, let’s go!
First attempt
The target
Litcrypt is a Rust proc macro that obfuscates text using a basic XOR method.
Strings are xored at compile time to hide them, and then are “decrypted” at runtime.